diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..09c32a2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+    open-pull-requests-limit: 25
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: ci
+    labels: [dependencies]
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 44a325f..517c9b2 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -4,20 +4,35 @@ on:
   push:
   pull_request:
 
+# The build only reads the repository.
+permissions:
+  contents: read
+
+# A newer push to the same branch or pull request supersedes a run still in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
+    name: gradle check
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '17'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Run gradlew check
         run: ./gradlew check
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..8979e2d
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,42 @@
+name: Workflow security
+
+# Audits the GitHub Actions workflows with zizmor whenever anything under .github changes.
+on:
+  push:
+    branches: [master]
+    paths: [".github/**"]
+  pull_request:
+    branches: [master]
+    paths: [".github/**"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Run zizmor
+        # The online audits (impostor commits, known-vulnerable actions, ref confusion) resolve
+        # every referenced action through the GitHub API. All actions used here are public, so the
+        # default workflow token is sufficient; a dedicated ZIZMOR_GH_TOKEN takes precedence when
+        # it is configured.
+        env:
+          ZIZMOR_GH_TOKEN: ${{ secrets.ZIZMOR_GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          GH_TOKEN="${ZIZMOR_GH_TOKEN:-${GITHUB_TOKEN}}" uvx zizmor==1.30.1 --no-progress --persona=pedantic .github/
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..8b8a13c
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+# Configuration for zizmor, see .github/workflows/zizmor.yml.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Our own shared infra actions deliberately track a branch.
+        "carrotsearch/*": ref-pin
+        "*": hash-pin